detect rogue only if with defined area?

[Leroy Plock]

Hello,

Has anyone ever tried to set up a system, using Cisco WLCs, Prime, and MSE, to do rogue containment, but only if the rogue is within a certain defined area? I thought it might be possible to draw the containment area on a map in Prime and base containment off of that somehow.

If we can't do containment based the defined area, if we could at least get a notification when a rogue is within the area, that would be good.

Thank you.

[Leo Laohoo]

the rogue is within a certain defined area?

Not possible because an AP could be transmitting at full power BUT is not physically within the containment area but the RSSI can be detected. 

What I have done is set up an alert with PI (Major Alert).  And this requires the Rogue Rules within WLC.  My setting is to alert me if a rogue AP can be detected with an average RSSI signal of -50 dBm.  

Remember, this is on a per-WLC settings only and cannot be set on a per-SSID or per-AP.  So use this carefully.

[Leroy Plock]

Thanks for the reply. So it's possible to determine with some precision where a client is physically, but not an AP. Is this correct?

I have been playing with the rogue rules based on RSSI as you suggested, but am finding the rssi values are unpredictable, they don't reliably correlate distance from the detector AP. I guess it's the same problem, you don't know what power the AP is transmitting at.

To narrow the alert to only certain APs, I've been working off of the SNMP traps. The rules in our trap collector look for the AP's MAC in the trap details, otherwise the trap is discarded.

[Leo Laohoo]

but am finding the rssi values are unpredictable, they don't reliably correlate distance from the detector AP. I guess it's the same problem, you don't know what power the AP is transmitting at.

I found the Rogue Rules for RSSI value to be the AVERAGE.  In my case, I have a known rogue AP inside a location.  With the Rules I've set, I can see in PI's "Major Alarm" of the Rule being triggered because of the average value of the RSSI to be -50 dBm (and stronger).  

The Rule doesn't get triggered with nearby APs because the average RSSI value is higher than -50 dBm even though, at least, one AP can detect the rogue APs signal to be -50 dBm (or better).